Overview

overview

10

Static

static

10

executable.1896.exe

windows7-x64

1

executable.1896.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    executable.1896.exe

  • Size

    348KB

  • MD5

    bd4c8a6106c3caa3ef9b316319d1175f

  • SHA1

    7e5fa3254f3ec6ebad91d636d2411963ab35be1c

  • SHA256

    4cc0ff5f75432f7fcfdfbc9583036653f718d32283868bbb4df55247e370578a

  • SHA512

    187222873bafcc2b0127985bffd2a791cdb0c8fa5c6e7e0ea3b3d8ffdb677bd086d1c3676c9196ace31813063b8744f08ce5d151f28e1e10d1ab002eb10f10e5

  • SSDEEP

    6144:W1UhIvTCqLgt+jcgVlklNltfs/Q8nbBdFn4Wzmjc1Ucdh1:GNTCpgVlklNltf58VpMc1pdh1

Score
10/10
frogquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Frog

C2

192.168.0.15:8282

Mutex

Froggi

Attributes
  • encryption_key

    TtCNbZ6r2jZKvoNxinWx

  • install_name

    Frog.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Frogs

  • subdirectory

    Frogs

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • executable.1896.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections